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Description 

The present invention relates to a method of ascertaining topology features of a network of the type comprising a 
plurality of sub-networl<s, spanning devices interconnecting the sub-networks, and statrans operative to source and/ 
or sink traffic to/f rom the sub-networks, the traffic being in the form of discrete message packets each including source 
and destination information. 

Networks of the aforesaid type are well known, their spanning devices sending to isolate local traffic (that is, traffic 
sourcing from, and destined for, stations on the same sub-network) to the sub-networked concerned, at least to some 
degree. Examples of such networks are: 

(a) - bridged Ethernets where stations. Identified by Ethernet addresses, are connected to sub-networks (also 
termed togical segments) which are interconnected by spanning devices in the form of bridges operating at level 
2 of the seven-layer OSI Reference Model: and 

(b) - Internet networks where stations identified by "ip" addresses are connected to "ip" sub-networks which are 
interconnected by spanning devices in the form of routers or gateways operating at level 3 of the seven-payer OSI 
Reference Model 

Monitoring systems for networks made up of a number of sub-networks are known In the art (see for example, 
IEEE Network: The Magazine of Computer Communications vol. 1, No. 3. July 1987, New York, US. pages 32 to 39; 
20 D Ritter et al: "A Multi-Purpose. Distributed LAN Traffic Monitoring Tool"). 

Knowledge of topological features of such networks (for example, the connection arrangement of stations to sub- 
networks and the interconnection of sub-networks by spanning devk:es) is of importance in rnonitoring and optimising 
the performance of the network and In planning for its expanston to cope with increased demand. However, such 
knowledge is frequently difficult to ascertain, particularly with large networks. For example, keeping up-to-date plans 
25 of the network by recording every change made, is not only time-consuming but Is, in reality, a virtually impossible task 
to carry through with complete accuracy; in addition, such plans can only indicate the intended connection state of the 
network and cannot take account of the failure of network elements such as the simple disconnection of a station from 
its sub-network. Physical Inspection of a network to ascertain its topology is also very difficult since much of the network 
may be hidden beneath flooring or located at remote sites. 
30 In the case of a network made up of a single sub-network, It Is possible to ascertain which statfons are connected 
to the subnetwork simply by monitoring the traffic on the sub-network; all stations sourcing traffic are obviously con- 
nected to the sub-network as there is no other source of trafTic outside the sub-network. However, where the network 
comprises several sub-networks Interconnected by spanning devices, it is no longer possible to make such simple 
deductions as traffic appearing on any one particular sub-network might have originated on another sub-network. 
35 It is an object of the present invention to provide a relatively simple method for ascertaining topology features of 
. a network that includes a plurality of sub-networks. 

According to the present invention, there Is provided a method of ascertaining topology features of a network of 
the aforesaid type, characterised in that said method comprises the steps of: 

- monitoring the traffic on at least some of said sub-networi«s to derive data concerning at least the origins of the 
traffic so monitored, 

- determining measures of the amount of traffic originating from a particular source, or a subset of this traffic, as 
seen on different parts of the networic, saki particular source comprising at least one station, and 

- comparing the sakj measures to determine which of said parts of the networt^ carries the nrlost traffic of interest 
from said particular source and thereby determine selected topology features of the network regarding said par- 
ticular source. 

The monitoring step utilises a monitoring device on each sub-network concemed. Such a device may be a stand- 
alone device or part of a spanning device or station connected to the sub-network. Each monitoring device is preferably 
operative to collect both source and destination information in respect of traffic on the sub-network and this information 
is then used to generate a partial traffic matrix, that is. a correlation between source stations and destination stations 
for the traffic seen on the sub-network concerned. However, it should be understood that the determining and comparing 
steps, depending on what topological features are to be ascertained, may not require all the data contained in such 
partial traffic matrices and the present inventbn should therefore not be taken as limited to the provision of the necessaiy 
55 data in the form of partial traffic matrices. 

The source Information In each message packet will generally only provide an indication of the originating station, 
although in certain networks, sub-network Identification is also carried in the source information. In the former case, 
the method of the present invention can be used to ascertain to which sub-network a selected station is connected; 
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this is achieved by having said determining step determine the amount of traffic originating from said selected station 
that is carried by each said sub-networlt, the said comparing step then determining the sub-network carrying the most 
traffic from said selected station, this sub-networl^ being taken as the one to which said selected station is connected. 
This process can then be repeated for each statton to build up a complete picture of the connection of stations to sub- 
s networks. 

The method of the present invention can also be used to ascertain whether a first sub-network is directly connected 
by a spanning device to a second sub-network; this is done by comparing, for some or all of the components of traffic 
originating on the first sub-network, the amounts of that traffic seen on the second sub-network with the amounts of 
that traffic seen on all the other sub-networks (that Is, other than the first and second sub-networks). In particular, three 
10 different methods for testing for a spanning device are provided. 

In the first of the methods for testing for a spanning device between first and second sub-networks: 

- said method includes the step of providing association informatran enabling the said source information included 
in a message packet to be used to identify a message packet as having originated from said first sub-network; 
IS . said monitoring step involves monitoring the traffic on said second sub-network and on each sub-network of the 
group of sub-networks made up of all said sub-networks other than said first and second sub-networks, 
said determining step involves determining, with the use of said association information, measures of the amounts 
of traffic sourcing from said first sub-network that are carried by said second sub-network and the sub-networks 
of said group of sub-networks; and 

said comparing step Is operative to use said measures to compare the said amounts of traffic sourcing from said 
first sub-network, that are respectively carried by said second sub-network and by the sub-networks of said group 
taken together, the comparing step detemiining that a spanning device directly connects the first sub-network to 
the second when the larger of these amounts of traffic is carried by saki second sub-network. 

In the second of the methods for testing for a spanning device between first and second sub-networks: 

said method includes the step of providing association information enabling: 

(a) the said source information Included in a message packet to be used to Identify a message packet as 
having originated from said first sub-network; and 

(b) the said destination information included in a message packet to be used to identify a message packet as 
having a destination other than said second sub-network; 

said monitoring step involves monitoring the traffic on said second sub-network and on each sub-network of the 
group of sub-networks made up of all said sub-networks other than said first and second sub-networks, 
said determining step involves determining, with the use of said association information, measures of the amounts 
of traffic sourcing from said first sub-network and having a destination other than on said second sub-network, that 
are carried by said second sub-network and the sub-networks of said group of sub-networks; and 
said comparing step Is operative to use saki measures to compare the said.amounts of traffic sourcing from said 
first sub-network and having a destination other than on said second sub-network, that are respectively carried by 
said second sub-network and by the sub-networks of said group taken together, the comparing step determining 
that a spanning device directly connects the first sub-network to the second when the larger of these amounts of 
traffic is carried by said second sub-network. 

The third one of the methods for testing for a spanning device between first and second sub-networks is applicable 
where the spanning devices used in the network do not act perfectly to block messages packets with a destination on 
a connected sub-network from passing through the spanning device from that sub-network to another. In this third 
method for testing for a spanning device: 

said method includes the step of providing association information enabling: • 

(a) the sakJ source information included in a message packet to be used to identify a message packet as 
having originated from said first sub-network; and 

(b) the said destination information Included In a message packet to be used to identify a message packet as 
having a destination on said first sub-network; 

said monitoring step involves monitoring the traffic on said second sub-network and on each sub-network of the 
group of sub-networks made up of all said sub-networks other than said first and second sub-networks. 
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. said determining step involves determining, with the use of said association information, measures of the amounts 
of traffic sourcing from said first sub-network and having a destination on said first sub-network, that are carried 
by said second sub-network and the sub-networks of said group of sub-networks; and 

- said comparing step is operative to use said measures to compare the said amounts of traffic sourcing from said 
first sub-network and having a destination on said first sub-network, that are respectively carried by said second 
sub-network and by the sub-networks of said group taken together, the comparing step determining that a spanning 
device directly connects the first sub-network to the second when the larger of these amounts of traffic is carried 
by said second sub-network. 

All three of the foregoing methods of testing for a spanning device are consen/ative in operation in that they may 
not find a spanning device which is present, but they are also safe in that they will not find a spanning device which is 
not present. 

The associatbn information required by all three of the methods for testing for a spanning device, associates 
stations with sub-networks. Where the source infomnation in each message packet inherently provides an indication 
of the sourcing sub-network, then the association infomnation is simply that required to interpret the source information 
correctly according to some predetermined scheme; in other cases, the ad hoc association between stations and sub- 
networks must first be determined (for example, in accordance with the above-recited method of the inventfon) and 
recorded as said association information. 

In all three of the methods for testing for a spanning device, the derivation in the determining step of the relevant 
amount of traffic sourcing from said first sub-network that is carried by the sub-networks of said group taken together, 
can be effected in several different ways. For example, the derivation can be effected by adding together the corre- 
sponding traffic amounts for each sub-network of said group without regard to any duplication that may occur as a 
result of the same message packet being monitored on more than one sub-network of the group. Alternatively the 
derivation can be effected by: 

• determining for each sub-network of said group, the components of the sub-network traffic sourcing from said first 
sub-network, that are destined for that sub-network and for said second sub-network, and 

- adding together the sub-network traffic components so determined for all the sub-networks of said group. 

Any of the three aforesaid methods of testing tor a spanning device can be effected in relation to traffic sourcing 
from said first sub-network either without regard to originating station on the sub-network (that is, by taking all stations 
together), or by taking each station separately and applying the test to traffic sourcing from that station on the first sub- 
network. 

Furthermore, where bi-directional spanning devices are used (that is, they permit traffic flow in both directions 
between the sub-networks they interconnect) each of the tests for a spanning device between first and second sub- 
networks can be carried out not only for traffic sourcing from the first network but also for traffic sourcing from the other 
said sub-network. 

It is, of course, possible to use all three methods of testing for a spanning device, in succession to test for a 
spanning device between the same pair of sub-networks (testing being stopped when and if a positive result is ob- 
tained). By applying the aforesaid methods of testing for a spanning device to each pairing of sub-networks of the 
network or the portion thereof under consideration. It is possible to detemiine which of the sub-networks are intercon- 
nected by spanning devices and thereby to build up a full picture of the network topology. 

In a preferred implementation of the invention, traffic infomnation on each sub-network is collected locally by a 
sampling monitoring devfce which transmits sampled data back to a central processing station. The processing station 
derives partial traffic matrices for all the monitored sub-networks and then processes the data contained in the traffic 
matrices in accordance with the methods of the Invention. In carrying out this processing, the processing station effects 
comparisons between traffic flows by using hypothesis testing in view of the sampled nature of the data provided to it. 

A suitable sampling monitoring device for use in implementing the method of the present invention is described 
and claimed in our co-pending European Patent Application No.90310699.5 filed 28th September 1 990. 

The partial traffic matrtees used by the processing station for deriving topology features of the network can. of 
course, be obtained In other ways such as. for example, by monitoring devices which derive and store these partial 
traffic matrices themselves, the partial traffic matrices then being collected and passed to the processing station. 

A method, according to the invention, of ascertaining topology features of a network will now be described by way 
of non-limiting example with reference to the accompanying diagrammatic drawings, in which: 

Figure 1 is an overall diagram of a network to which a processing station and a number of sampling monitoring 
devfces have been connected to form a network monitoring system Implementing the method of the 
invention; 



4 



10 



EP 0 460 555 B1 

Figure 2 is a diagram Illustrating the general form of a data packet transmitted over the Figure 1 network; 
Figures 'sablockdiagramof a sampling monitoring device of Figure 1; 

Figure 4 is a flow chart illustrating the main interrupt sen^ice routine run by a controlling microprocessor of the 
Figure 3 device; 

Figure 5 is a diagram illustrating the main data structures utilised by the processing station of Figure 1 in processinq 

data from the sampling monitoring devices; 
Figure 6 shows an example partial traffic matrix for a sub-network of the Figure 1 network; 
Figure 7 is a flow chart illustrating a main program run by the processing station; 

Figure 8 is a flow chart Illustrating an interrupt service routine which is run by the processing station, upon receipt 

of data from a sampling monitoring device, in order to build up partial traffic matrices- 
Figure g is a flow chart illustrating a "station-allocation' routine called by the Figure 7 prograrii to determine the 

association between stations and sub-networks of the Figure 1 network; 
Figure IDA is a diagram illustrating possible traffic flows in the network between two sub-networks Y and X when 
they are connected by a bridge; 
IS Figure 1 0B is a diagram similar to Figure 1 0A but for the case when no bridge interconnects sub-networks Y and X 
Figure 11 is a diagram illustrating possible leakage traffic flows from sub-network Y when no bridge inter-connects 
sub-networks Y and X. 

Figure 12 is a flow chart illustrating a 'tests for bridges' routine called by the Figure 7 program to determine which 
pairs of sub-networks are inter-connected by bridges; and 
20 Figure 13 is a flow chart illustrating a first test for a bridge' sub-routine called by the Figure 1 2 routine. 

Figure 1 illustrates a typical local area network in which a plurality of stations 11, 12. and 13 are interconnected 
via cable segments 10A. 10B. and 1 0C. The network is divided into three sub-networks by bridges (spanning devices) 
u that connect respective ones of the cable segments 10B. IOC to the cable segment 10A. As is well known in the 
art. the bridges sen/e to filter traffic passing between the network segments, such that messages originating from a 
particular segment and destined for a station on the same segment (local traffic) are not passed through the bridge or 
bridges 14 to the other segments whereas messages originating in one segment and intended for another one (non- 
local traffic) are allowed across the bridge. The operation for such bridges Is generally imperfect and some local traffic 
will usually 'leak' through the bridges. w^aiuam^ 
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In the Illustrated local area network, messages between the statfons 11. 12 and 13 are transmitted in the form of 
packets that are broadcast over the network. Typically a packet will have the form illustrated in Figure 2 with a packet 
header 15 containing a source address (the address of the station sending the packet) and a destination address (the 
address of the station intended to receive the packet), and an information field 16 containing the data to be passed to 
the receiving station and normally including error checking codes. Depending on the particular packet format being 
used, other fields may also be present; thus, for example, there may be a CRC (cycle redundancy check) field coverina 
both the packet header and information field. ^ 
The Figure 1 network may, for example, be an Ethemet network well known to persons skilled in the art 
The network of Figure 1 is arranged to be monitored by a network monitoring system comprising a plurality of 
monitoring devices (stations 12) and a central processing station 1 3. Each of the monitoring devices is associated with 
a respective one of the sub-networks of the network. As will become clear below, each monitoring device is operative 
to randomly sample the packets on its associated sub-network and transmit data on the sampled packets back to the 
processing station 1 3 for processing and analysis. 

The form of each monitoring device Is illustrated in Figure 3. The device comprises a network Interface 20 a 
microprocessor 21. and ROM (non-volatile, pre-programmed memory) and RAM (re-writable memory) units 22 and 
23. These units 20 to 23 are all Interconnected via address, data and control buses 27, 28 and 29. The network interface 
20 is operative to carry out all the low level functions necessary to interface the monitoring device of Figure 3 to the 
network cable 1 0 and to pass received packets to a receive queue, in the form of a FIFO (First In First Out) buffer 25 
in RAM 23. The network interface is further operative to transmit packets held in a transmit queue formed by a FIFO 
buffer 26, in RAM 23. The network interface 20 thus constitutes packet receive means and packet transmit means for 
the monitoring device. In the present example, the network interface 20 is arranged to receive all packets regardless 
of their destination address contained in the packet header Furthermore, the network interface 20 is operative to pass 
only the header portion 30 of each received packet to the receive FIFO buffer 25. 

The network interface 20 is arranged to operate in coordination with the microprocessor controller 21 and in 
particular, informs the microprocessor 21 each time a packet header is inserted into the receive FIFO buffer 25 'by 
55 means of a suitable interrupt control signal. 

The network interface 20 also contains various counters 24 which hold a number of counts including the total 
number of packets received, the number of packets received which according to their CRC field are in error, the number 
of packets received below the minimum accepted length (RUNT packets), and the number of packets received above 
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the maximum accepted length (JABBER). 

Implementations of the network interface 20 for particular network protocols are well known in the art Thus for 

?M ROM 00 h^!! 3" approprate microprocessor constituting the microprocessor 21 is the Intel processor 801 86 
The ROM 22 holds the programs run by the microprocessor 21 and also a table of random count values orede^ 
temnined according to an exponential distributkjn. 

The processor 21 is operative to run a background program in which it does nothing (ie an idling prooraml The 
main working pragramforthep«)cessor21 is an interrupt sen^iceromine Which iscalled each time th^^^^^^^ 
20 generates a processor interrupt to tell the processor that it has stored a new packet header in the rec^^ RFoS 
The mterrupt serv.ce routine, which will be described in more detail below, operates to randomly selec a rece^v«i 
packet header and form it into a collected^ata packet together wHh the current count values of L c^nxl^l^^ 

ST. ^TZir '"T" """^'"9 predetermined random counts stored in ROM 

22. The conected-data packet so formed is put into the transmit queue FIFO 26 and, In due course is transmitted bv 
the network interface 20 back to the processing station 13. The header of each collected<lata packet Ss as Ss 

source address the address of the monitoring device concemed While the destination address is°hat 
station (alternatively, a multicast address can be used to which the processing station is set to liaen 

A more detailed description of the operation of the monitoring device will now be given with reference to Figure 4 
wr.ch,saflcw chart of the interrupt seniles routine mn by the microprocessor21.T7,emicroprocess^^^^^^^^ 
to be in a state in which it is running its background (idling) program and in which it has one of the random count values 
held in an internal register (the fetching of the first count value upon switchon of the monitoring device wou^be part 
of an inrtialization routine). It will also be assumed that the receive and transmit FIFO buffers 25 and 26 are ernotS 
FIFO hu'^rT^ IT"^^ ""^^ °' 20 passes the packet header to the receive 

interrupt, the microprocessor 21 executes the interrupt service routine illustrated in Figure 4. The first step i o h s 
routine carries out the normal house-keeping tasks associated with such routines including saving the volatile env 
ronment parameters of the background program and masking further interrupts. oiame envi 

Next, the mteroprocessor decrements the random count value held in its internal register (step 41) and then checks 
the remaining value to see if this has been reduced to zero (step 42) P i J ana men cnecks 

buffer Js^slT^r' 21 '''^'^"^^ head myxry in the receive FIFO 

Thereafter, the microprocessor must check the receive FIFO buffer 25 to see if any further packet headers have 
been entered intothebufferbythenetwork interface 20duringthep^^^^^ 

44). Generally this will not be thecase and themicroprocessor will then exit its interrupt service routine andr^^^^^^^^^^ 
background environment and unmask its interrupts (step 45). However, in the event that the receive FIFO buffer 25 
contains a further packet header, the interrupt service routine will pass from step 44 back to step 41 

If dunng the test (step 42) carried out on the count value held in its internal register, the microprocessor 21 finds 
thai this count value has been reduced to zero, the interrupt sen/ice rautine will proceed to gene-ate a collected<^te 
packet 31 inrespect of thepacket header at thetop of the receive FIFO buffer25 (step 46)^ 

S IT^T^ '^r" ^ ^^^^^^ ^' -""t values Z t^Sume 

24. theadd ess of the monitonng device (source address for the collected-data packet) and the address of the process- 
ing statran (destination address for the collected<Jata packet header). After the collected-data packet has bean as- 

BOMSS^^r^.^'^^ ^* '""'^""^ "^i^oP^^^^^^o^ '«t<=hes a new random count from 

Tl^r^ stores this new random count in its internal register (step 47). The microprocessor then proceeds to step 
44 and running of the interrupt service routine proceeds as previously described 

The Size of the receive and transmit FIFO buffers 25 and 26 can be quite small, for example, sufficient to hold only 
two or three entries. This is possible with respect to the receive buffer 25 because in general the inten/al between 

T microprocessor 21 to run i,s liHpt 

r«jtine and clear the top entry from the receive buffer; in any event, the occasional overflowing of the receh/e buffer 
25 IS not of major consequence since the missing out of a packet will general^ have minimal effect on the statistfcal 
measurements being conducted by the networi. monitoring system. This equally applies to the transmit buffer 26 where 
an overflow is even less likely to occur as its entries ara only in respect of the randomly selected ones of the received 

p3CK3t5. 

The above-described implementation of the monitoring device does mean that the count values included in a 
collected-data packet from the counter 24 may not be the count values current at the time that the relevant packet was 
actually received by the network interface (this is because of the possible delay in actually processing ttie packet 
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ST^JLIT/h?^^'"' '^'^'^ aspect will be minor and will have minimal effect on the validity of 
the statBtKa^ly determined results p«xJuced by the network monitoring system. Of course, it would be p^s2 to 

t^JT'^.Tf'- ^"^""^^ "^'^^^ 24 with the header of each eceled pa^kJt 

however, the added circuit complexity needed to do this is generally not justified ' 

The data structures usedto implementthe receive and transmit FIFO buffers 25 and 26 In RAM23willbeaDDarant 

oape^nskjledintheart and willtherefo™ no.be described hereh.Fu,the^^^^ 

n the Rgure 3 emb^ment the random selectton of incoming packets has been effected by stor ng prSeteS 
random numbers .n ROM 22. these random numbers could alternatively be generated as and vJien rSrid bJ iS 

Si """^Tr '"T '° ^" ^"''^^^ ''^^'^^ P^'kets of ninety nine; oth^vaSS! may 

be more appropriate depending on traffic density, sampling period and acceptable statistfcarerror level The r^Z 
selecnon o packets could be effected on a time basis rather than on the number of packets received 
inn JTr '° I'lt^^ P^'^'^^'s °^ by the monitoring devices 1 2 over the network are all received by the process- 
ing station 1 3 which stores these packets and carries out subsequent processing and analysis 

through ^T^rr^"!!"""/^ by a standard wortcstation interfacing with the network 

through a network interface (not shown) simibr to the interface 20 of the Figure 3 monitoring device 12 Such a 

i alT^T ' " , ""^"""^ '"'"^ ^ and program segments S 

^h tSe nlTr'". °' "T'^'- ^ P"^'^' '•'^ RAM memoiy i'n acco Jance 

20 are aH standard and well known to persons skilled in the art. " oi> • ««s iney 

The processing station 13 carries out three main tasks, namely; 

(1 ) - generation of traffic matrices for each sub-networi. on the basis of the collected-data packets received- 
2S a '.^^.n^fo '.K " °' stetions 11 With the various sub-networks using the sub-network traffic matrices; and 

(3) - testing for the presence of bridge between all pairs of sub-networks by using the sub-network traffic matrfces. 

* processing station 1 3 in canying out these tasks are illustrated in Figure 5 

the data stnicturesbemg created and maintained in the RAM memory of the statk5n13. The main dat^ sJurtu^^^ 

30 Input-queue 50 . this Is a queue of collected-data packets required by the network interface of 

the station, each packet being temporarily held in the queue pending process- 

Sub-Network Ust 51 . this is a list of all the known sub-networks of the network with each sub-network 

^ having a respective entry comprising a fieW storing the sub-network identity SN- 

statinn I i.. M '°' ^ TM-POII^ER, and a second pointer S-POINTER; 

station List 52 -thisisalistof alltheknownstatkMis 11 of the network with each station having 

a respective entry comprising a fieW storing the station kJentity S-ID, and a point- 
er NEXT-S POINTER. The first station to be associated with any particular sub- 
^ netvrork is associated with that sub-network by selling the S-POINTER of the 

corresponding sub-network entry in the sub-network list 51, to poht to the ap- 
propriate station entry in the station list 52. The association of further stations 
with the same sub-network is achieved by using the NEXT-S POINTER of the 
last preceding station associated with the sub-network to point to the entry of 
the next station to be associated with the sub-network, thereby buildino ud a 
linked list of stations. ""^ 
Sub-Network Traffic Matrix 53 - This is an array fomied for each sub-network to hold the partial traffic matrix 

data for the sub-network. The traffic matrix array relevant to a sub-networi< is 
pointed to by the pointer TM-POINTER of the corresponding entry in the sub- 
network list 51 . Figure 6 illustrates a typical partial traffic matrix giving tor each 
source station/ destination station pair, the number of packets carried by the 
sub-networi< concerned in a given interval of time (the different statksns 11 are 

here designated 11A. 11B, 11C 11N). 

ndge List 54 . This is a list of all the known bridges of the network with each bridge having 

ss 3 respective entry comprising a fieM storing the bridge kJentity BHD. and a pair 

of fields for storing the identities (SN-ID) of the sub-networks connected by the 
brkJge. 

Having outlined the main data structures used by the processing station 13, a description will now be given as to how 
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the station carries out its tasks using these stnjcturos. 

or^HrTjL^'^'^"' ''!? P'°^^^^'"9 13 is illustrated In Figure 7. Upon start up of the program, a 

predetermined t'me pe„od, e.g. 1 hour, Is tinned (steps 60,61 ) during which the main program is idle but collecteStJ 
packetsarerece-ved by the processing station andprocessed by an interrupt sen^iceroutLtoc^^^^^ 
for the sub-networks of the network. After time-out of the predetermined time interval, the main p^ram cam' To^^ 

.rst of an by associatrng stations with sub^ietworks using a 'station allocation' routine (step 63), and then by a^cer- 

h"! nf.TTl'^•^'"'®''"'*' '° "^""^ sub-network traffic matrices from the received col- 

lected-data packets The .nterrupt service routine Is called in response to the generation of an interrupt by the neTv^'k 
interface of the station 1 3 following the receipt thereby of a collected^ata packet and the storage of Sat packettThe 
input queue data structure 50. Upon start-up of the interrupt sen/ice routine, the normal housekeeping tasks of s or ng 

!Li»^ H 5 r'T,'"' "^"^^^ ""^ '"^^^'"S '"^^^^"P'^ «''«<='«d (^^«P 65). Next the header Se 
collected-data packet at the top of the input queue is examined (step 66). The source address contained in the header 
Identifies the monitoring device that generated the collected<Jata packet; indeed, on the assumption thatone monltorho 

the assocated sub-network. The monitoring device addresses are therefore used either directly or Indirectly as the 
sub-network identities SN-ID. By examining the source address contained in the header of the collected^ a packet 
under exarnination. * is therefore possible to tell, by checking against the sub-network list 51 . whether ShTcolS! 
date packs comes from a known sub-network or whether the packet indicates the presence of a prevfously unknown 
sub-network (step 67). If a new sub-network is identffied. then a new entry is made in the sub-net^S 51 aZ 

toTe ntw ' I' "'^"'"^ TM-POINTER of the sub-network entry is set to poim 

to the new traffic matnx array whilst the S-POINTER is set to null. 

r.^Jl'^'^^T' "1^""^^ ^^""^^ °" *° examine the contents of the data field of the collected^Jata 

n the data field to ascertein if either of these addresses indicates the presence of a previously unknown station thS 
•■If rcC?'c"l"^'"''' ''^'^ '''' =2 (step 70). If a new station Is identified, then the stetion list MfeSat^ 
iriion Sep 7?) '° ""^ '^'"'^^ ''''''''^ to iSIS 

Once the foregoing preliminary steps have been effected, the interrupt service routine updates the traffic matrix 
53 for the relevant sub-network (as Identified by the source address In the header of the coWtedXpackT« by 
"^T"'"^ station/destination statfon pair concerned (as indicated by the addresses held in 
the data field of the colleted-data packet) - see step 72. 7001 laiu m 

Because of the sampled nature of the information provided by the monitoring devices 12. the sub-network traffic 

This processHig is effected in step 62 of the main program at the time-out of the sampling period. However in orde 
to carry out this processing, it is necessary to record the total number of packets carried by each sub-network durina 

field of each coliected-data packet sent to the processing station 1 3, In order to ascertain the total number of packete 
.hlofrr," ^"^7*^°^":^ """9 ^^-^P'ing period, step 73 of the interrupt senate routine is operative to record both 
the current packet count for the first collected-data packet received in respect of a sub-network and also the currem 
packet count of the most recent collected-date packet received during the sampling period in respect of that sub 

the totel number of packets carried by the sub-network during the sampling period 

Finally, the input queue 50 is checked to ensure that no new collected-date packets have been received whilstthe 

ZTyLT"". "T" ^"""'"^ ^^""^'"9 ^ '"'«""P' routine teTmSes 

(Step 75) by restoring the mam program environment parameters and unmasking the interrupts. In the event that the 
input queue IS not empty, steps 66 to 73 are repeated. n me evenunai the 

Foltowing the temiination of the sampling period, the main program calls the routine for effecting statistical orocesa- 
ing of the sub-network traffic matrices (step 62 of Figure 7). This processing invoh/es deriving for each element of each 
sub-network traffic matrix, mean and variance values for an assumed nomial distribution, these values being stored 
back irito the relevant traffic matrix array In order to cateulato these mean and variance values. It is necessary to know 
not only the basic aggregated number of relevant samples V constituted by each traffic matrix element (that is the 
number of samples of a class'C) . but also the total number 'o' of samples Involved in the generation of the relevant 
sub-network traffic matrix, and the total number of packets T carried by the sub-network during the sampling period 
The totel number 'o' of samples can be obtained either by summing all elemente of the relevant sub-network traffic 
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T^^J'nX^T,^ '^"'^"3 ^"^'"^ P*"'=«'- ^ "^'^^^ <^fecussed. the total number of packets V 

estimate of mean = iojo 

c (1) 

estimate of variance = f^(o-o )o /o^ 

n^Ji^lll7J!TT. °' ^ ''^'^^ "^'"9 •^yP°»f'«^'s '««'i"g techniques in view of the statistical 

nature of the quantit.es concerned. Such techniques are well known to persons skilled in the art can L 1™ 

It "indeterminable- judgement made for the station) 
Step 87 loops the process until all sub-network traffic matrices have been examined in resoect of a Dartir.,i«r 

!? u ? ^""-"^^""'''^ by -CC-ID- (as indicated by the null setting of the pointer S^OIiJtER n th«%. ^ 

network entry), the S-POINTER for that sub-network entry is set to point to the entrain restSioniSS^r ! 
to the station (identity "S-ID") under consideration (step 88) Where he stattTu^^^n^^^ 

station entty is set to point to the entry for the station under consideration POINTER of that 

After allocating stations to sub-networks, the main program (Figure 7) initiates the test.! for hriw„»o. • 
Consider the case where it is desired to ascertain whether a bridge directly connects two sub-networks Y and X 
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n«5!l^ to a'low non-local traffic on sub-network Y to pass to sub-network X. If the remaining sub-networks of the 
network (that is. the group of sub-networks other than X and Y) are considered as a group R then the network an^ 

does d. ectly connect sub-networks Y and X. and by the diagram of Figure 10B in the case where the^fe no b Woe 
connecnng sub-networks Y and X. In these diagrams, various traffic flow components are representedTy he ?e5^ T 
followed .n parenthesis by letters representing the sequence of sub-networks followed by the STco^ZTuZ 
Its source on sub-network Y. to its destination. Thus the component of traffic sourcing on sub-netw^rkT^S mJ^J^ 
to sub-network X through the sub-network group R. is represented by T(YRX) -neiworK y and passing 

n.t Jl!!."^";'^ traffic flow components T(YRX) and T(YRXR) shown in Figure iOA. will only be present where the 
network topotogy includes a loop providing both a direct and an indirect path to sub-network X Indeed. Se traSS 

rrriris'rj2x°"'^^^^ 

suh l^^lrTrl 'T! ^ ~"'»''^«^««°n is given to what elements of the total traffic coming from 
sub-netwo k Y (rega cliess of destination) are seen on the sub-network X and on the subnetwork group R In thte 
consideration, the following representation is used: ^ ^ 

T, = all traffic from sub-network Y, regardless of destination; 

|T,lx= that part of T, seen on sub-network X; 

T, (Y..) = that component of T, foltowing the route indicated in parenthesis. 

By reference to Figure IOA. It can be seen that when a brkjge directly links sub-network Y to sub-network X: 

[T,]x = Ti(YX)+Ti(YXR)+T,(YRX) + T,(YRXR) O, 

I^iIr = T, (YR) + (YXR) + T, (YRX) + (YRXR) (4) 
Formulae (3) and (4) represent the most general cases. The last two components of both formula (3) and (41 will 
not be present in a non-looped network where there is only a direct path to sub-network X. Furthermore these coT 

network X?"° """" *° "^""^ ^°^* " ^^""^ ^ ""'^^^ '"'^''"y "■"'^'"9 sub^ietwork Y to sub- 

[T, ]x = T, (YRX) -^T, (YRXR) (5j 

Ti]r=Ti(YRX)+Ti(YRXR) + T,(YR) (6j 
from which it follows that, absent a bridge connecting sub-network Y to sub-network X, 

n"i]R>=rri]x (7) 

If formula (5) is not satisfied, le. if: 

n'i]x>[Ti]R (8) 
then a bridge must exist directly connecting sub-network Y to sub-network X Stated in words, a bridge can be taken 
to exis between sub-network Y and sub-network X. if there is more traffic from stattons on sub-netSro^ seen on 
ble Itn ' ^kT T'' ^"''-"«»««^^'« the remaining group R. This test v^ll not necessaH^ identVa 
S extls sub-networks Y and X. but it will do so in many cases and will not find a brfdge where 

^^v!"?" °* ^^f ""^^ '^"^ ^ "''^^s is similar to the first but only considers the traffic sourcing from sub- 
net««>rkYthatisnotdestmedforsub-networkX. this traffic being de^ 



n'2lx=T2(YRXR) 



(9) 



n"2]R = T2(YR) + T2(YRXR) (10) 
From this it follows that in the absence of a bridge: 

n"2)R>=(T2]x (11) 
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if formula (1 1) is not satisfied, i.e. if: 

n"a]x>[T2l„ (12) 
then a bridge must exist directly connecting sub-network Y to sub-network X. In other words, a brkJge can be taken to 
fn Ih T" IT"'"^'^ ^ subnetwork X. if there is more traffk: from stations on suLeZkTnot Sned 
or sub-nehvork X. seen as sub-network X. than seen on all the sub-networks of the remaining group R lain !5s 
test will not necessarily find a brkJge but it will not find one if one does not exist ^ ^ ' 

.h=* J^'"* °' '^'^^ presence of a bridge relies on the fact that most practical bridges are ■leakV 

that ,s they allow a small portion of the traffic destined for a sub-network connected to the bridge o ^rtZgh the 
brdgetoaconnected sub-network This leaked traffic wasnot taken into account in consideringthet^^^^ 

reZr,:d'3rir'°"°^^^^ 

♦r^ffi™!!!"'*' f "''""^ sub-network Y and destined from sub-network Y is designated T,, then the possible 

depend on the natureof the operation of thebrldges of the networi<. Thus. Whilst the bridges may se 

leaked traffic from further transmission through the networi*. this may not always be the case. Lo7^ngr?Lurl^i 

SSetdr ^ 

From Figure 11 it can be seen that in the absence of a bridge linking sub-network Y to sub-network X: 

ITsIx = T3(YRXRY) + T3(YRX) + TgCYRXR) (,3) 
ITsIr = T3(YRXRY) + T3(YRX) + T3(YRXR)+ 

+T3(YR)+T3(YRY) (l^j 
From this it foltows that in the absence of a bridge: 

^ah [TsJx (15) 

If formula (15) is not satisfied, ie. if: 

n'3lx>fT3]B (16) 
then a bridge must exist directly connecting sub-network Y to subnetwork X In other words, a brWge can be taken to 
ex,st between sub-network Y and sub-network X, if there is more traffic from stations on sub-netv^rkTdestoed fS 
sub-network Y. seen on sub-network X, than seen on all the sub-networks of the remaining group^ Aga'n ISfe tis 
will not necessarily find a brUge but It will not fine one if one does not exist 

It will be appreciated that in view of the direction of the inequality in fomiula (16). superimposing the leakaae traffic 
forras(8^^^^^^^ 

thr« ' K H ^'^'^ ^ 2 °' subnetworks and then applies each of the 

T^^r, J^^ °' " ^"'^ ^'^y unWirectlonal - that is. they test for whether there 

IS a bndge connection allowing traffic flow in one direction from one sub-network to the other. However Zrou ine 3 

subsequently applying the tests to the sub-network pair in the ordering 

Considering Figure 1 2 in more detail, each sub-network of the sub-network list 51 is taken in turn as the first sub- 

the sub-network Y each of the remaining sub-networks is taken in turn as the second sub-network X of the paifof suth 
networks to be tested (step 93). Once the pair of sub-networks YX to be tested has been set up test ,or a 

to see whether the test were successful, if it was, then the second and third tests are not applied to t^e ^^^5? 
However, rf a bridge was not found by the first test, the second test is then executed (step 96) 

t«st Lfr*'°'"'''°"°"f??.^'°*^" ^ """"^^ ^"^^ ^"^^^ Paring YX (step 97). then the third 

test for the presence of the bridge is carried out (step 98). » i k i. ■oiiuiomiro 

^^T^" '^^"^^'^ ^ "'''^9® ''^^ '"""'^ "^t^een the sub-network pair YX or all three 

?»? ?. r T'f "° "'"9" a "ridge has been found, the bridge list wil haSe 

been updated as the final step of the relevant brkJge test sub-networt< 'oge "si win nave 
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/steo M n !1? TJ T^"^ ^f' ""^ " ^^'^^ "^P'"9 "^^"^ '° ^«'«'=^ next second sub-network X 
nZSv L^^ all the sub-networks (except for the current Y sub-network) have been used as the secSub- 
network X. by loop^ig back to select a new sub-network for the first sub-network Y (step 100) 

routi^elTminated" '"""^^ '^^^ '"'^^ " •'^^ t-t tor bridges- 

Figure 1 3 illustrates the first test for bridge" sub routine It will be recalled that thic fire* t 1 . 
the t^i Of ^1 the trafnc «,urcing from a first sVnetwork J a:^l^Vr::Sndi: e ^^ f^ wSZaS 

^ °" sub-networks (that is. excepting X and Y ^elrs 

step 102 of the sub rout.ne involves accessing the traffic matrix for the sub-netwo k X and summino alS^urcilo 
f«,m sub-network Y (this traffic being the traffic originating from the stations on sub-neK^rkT "he^i s^^^,^ be S 

rrrerrt^rt"^^^^ 

Next, in step 103 and 104 the traffic matrix for each sub-network other than the networks Y and X is examined In 
turn and an accumulative total arrived for traffic sourcing from sub-network Y no regard being pad to t e JartTaUhe 
^uLTl T'T^ T ^ ''^ °" °' sub-networks unS^r cons^^^^^^ 

total traff c value der^ed from all these sub-network traffic matrices is stored In a variable representinq m Nei Z, 

processed, th.s companson ,s done using hypothesis testing techniques. It the value of F,]x is greater th^ the value 

X ^ ' H °'"°? '""f ' ^ '"^^9" "'"^'^ ^i^e-^tly from subnetwork J tS-net,2^^k 

X a correspoTKiing entry is therefore made in the bridge list identifying the new bridge and the first anti T^^^^ 
networks mat It links (step 106), Thereafter, the first test for bridge" sub-routine ,e«s 

The second test for bridge" sub-routine is similar to that shown in Figure 1 3 except that onlv traffic soureino from 

Sl^i^S^^^^^ T"T' ^""-"^'""^ " '''^ correspondirglX Sn "^^^^^^ 

The th^d test for a bridge" sub-routme is also similar to that shown in Figure 1 3 but with only traffic sourc no rom 

for .Tl '° ^l^^^-^l^^^^ed topology discovery methc!d. For example, the or each tSt 

f«^a bridge can be applied ,n respect of traffic from any particular station on the sub-network Y of a sub-netTork S 

th^ ,S w ? ''^'^'''^ '^^"'^ '"^ ^^^f^ the subHietwork Y FuIeiiSre 

13 «t the end of the sampling period; in this case, the monitoring devices could record each and every packet rather 
han sampling he packets. Where on^ parlicubr topotogy features are required or only particular tests are to bl ufed 
me prov«,on of the full range of traffic Information such as is contained In the sub-network traffic riatrfce il unnS 

Sa2 ^p^t^r '''' '^'^^3^ '° ^"''^'^^ ^"^^ '"'°^-«tion combed n a pTcket 

ITS directly the onginating sub-network, the monitoring devfces can directly record how many packets are 2 

^r-^rera-^b^-^^^^^^^^^^^^^^^ 

w«rtf' JwrnK'^^ ^"""^ "-"f '^^^'^ '^"^^ i" elation to an Ethernet-type net- 

r^liC^XTures ' ^^"""^ ^° - - networ.t aTe^:: 

The foregoing topotogy discovery method has been described In terms of data structures that can be readih/ Im 
plemented using tradftional programming techniques that consoler programs and data as se^Tate^Itt howe^^^^ 
graX'" '""'""^"'^ "^'"9 '^"^^^^ -^<^^^ obSt^'enterpro^^ 



Claims 



A method of ascertaining topology features of a network that comprises a plurality of sub-networks soannina 
devices (14 interconnecting the sub-networics. and statfons (11 ) operative to «,urce and/or sJtSZZe 

nfoZZ M.^H^'"1 '"'"^ °' '"^'^'^ "'^^^^Se packets each including sour^ and SIratS 

information (15). characterised in that said method comprises the steps of: aesiinaiion 

' t^^'s^^Sed" °' '"'-"''"""^ ^° "^^"^^ t''^ o^i9'n3 of 

■ determining measures of the amount of traffic originating from a particular source, or a subset of this traffic 
as seen on different parts of the network said particular sou«:e comprising at least one station and 

' ^"rS"^. '° "^'^""'"^ ^'^^ °' '^'^ P^^^ °' "^'^"^k carries the most traffic of Interest 

from sari particular source and thereby determine selected topology features of the network regarding saS 
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particular source. 



3. 



4. 



S. 



6. 



ITI Sh ^ • °'^^^''^''"i"9 «° ^►'ich said sub-nelworka selectedsaid station (11) is connected 

H H 'r""-'''°TT "'^^^ae packets senses to identify the stations sourcingTl^e 2ck 
I;,! m f step (65-75. 84) sending to determine the amount of traffic originating from said seleTed 

tu^Z^T " 'T' "^^^ subnetwork, and said comparing step (85^ "ivolv^g de^elr^S 

rhrd^s^sixsi^^^^^^^^^ 

A method, according to claim 1 . of ascertaining to which said sub-networks said stations (11) are connected whfir« 
being carried out for all stations concurrently. ; 

™t^H^'^''l'??/f ^ • °* ^^^^^'"'"9 whether a first said sub-network (Y) is directly connected by a said 
spanning device (14) to a second saw sub^ietwork(X). wherein: necieooyasaia 

■ said monitoring step (40-47) involves monitoring the traffic on said second sub-network (X) and on each sub- 
suSiks' °' ^""-"^'^^^'^ °' ^^''^ s"b-networks other than Lid first ^d seTd 

- said detem^ining step (65-75. 102. 103) involves determining, with the use of said association information 
measures of the amounts of traffic sourcing from said first sub-network (Y) that are carried by iaSTecTd 
sub-network (X) and the sub-networks of said group (R) of sub-networks and 

- said companng step (105) is operative to use said measures to compare the said amounts of traffic ([T,! 
ITi],) sourcng from sa.d f.rst sub-network (Y). that are respectively carried by said second subSu^Sxi 

ZZ l l^^T ' ^""■"^'^'o* (Y) to the second (X) when the larger of These amZZl 

traffic IS earned by said second sub-networi< (X). 

lTn?r*H^^°' ^ • °* ^^<=^''«'"'"9 ^^e'her a first said sub-network (Y) is directly connected by a said 
spanning device (1 4) to a second said sub-network (X), wherein: 

- said method includes the step of providing association infomiation (40-47. 65-75. 63) enabling: 

(a) the said source infomiation Included in a message packet to be used to ktentify a message packet as 
having onginated from said first sub-network (Y); and 

(b) the said destination information included in a message packet to be used to IdentHy a message packet 
as having a destination other than said second sub-network (X); 

■ ^ """"""""S traffic on said second sub-network (X) and on 
sLSrS^Lb^^^^^^ °' ""'^^ °' ^" ^^'^ sub-networks other than said S anS 

" ? l^JZnl" of l"'^^^"''''' 1"'°""' ^^^^^"""'"9' «'«h the use of said association infom«tlon. measures 
of the amounts of traffic sourcing from said first sub-network (Y) and having a destination other than on s^ 

■ said comparing step [96] is operative to use said measures to compare the said amounts of traffic (FTolv fT 1 ^ 
sourong from said first sub-networi. (Y) and having a destinatbn other than on said sec2 slSrk S 
hat are respect^ely carried by said second sub-networi. (X) and by the sub-networks of saW group (R) taken 

Y? to mV«^/vf"I''TK''T'""'"? ^ """""^ ~""«<='« the first sub-network 

(Y) to the second (X) when the larger of these amounts of traffic is carried by said second sub-network (X). 

A method according to claim 1 . of ascertaining whetherafirst said sub-network (Y) is direct^ connected by a said 
spann ng device (14) to a second said sub-network (X) where the spanning devices (14) used in the netiork do 
not act perfectly to block messages packets with a destination on a connected sub^ietworkfrom passing thnDug^ 
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the spanning device (14) from that sub-network to another, wherein: 

- said method Includes the step of providing association infomiation (40-47. 65-75. 63) enabling: 

(a) the said source information Included in a message packet to be used to identify a message packet as 
having originated from said first sub-network (Y); and message packet as 

(b) the said destination infomiatlon Included In a message packet to be used to identify a messaqe packet 
as having a destination on said first sub-network (Y); . "message packet 

- said monitoring step (40-47) involves monitoring the traffic on said second sub-network (X) and on each sub- 

- said determining step (65-75. 98). determining with the use of said association information measures of the 

1^7^1Z1Z"V°" ^ ^"'^ •^^^'"9 a destination on said f^st sub" etiS 

(Y). that are earned by sad second sub-network (X) and the sub-networl« of said group (R) of sub-netw^ 

- said comparing step (98) is operative to use said data to compare the said amounts of traffic (fT,lv fT 1 \ 
sourcing from said first sub-network (Y) and having a destination on said first sub-netlr^m'Sf a S 
specvely earned by said second sub-network (X) and by the sub-networks of said group ^) ta£Sher 
IZ^l 'f '""'"'"^ " device (14) directly connects the first sub-network (?) to thi 
second (X) when the larger of these amounts of traffic is carried by said second sub-network ()q 

A method according to claim 4. 5 or 6. wherein said detemiining step (94; 96; 98) derives the relevant amount of 
traff,csourc,ngfromsaidfirst sub-network (Y) that is carried by the subHietwoks of said gro^ 
by addrngtogetherthecorrespondingtraffic amounts for each sub-network of said group(n)iith^^^^^^^^^ 

"T"' '° '° ''""''^ '''' sub-netwon. of the packet. saiS de eSng 

TsZV^':z::zii^ir''' '-^ ^^^^ ^ .he s:^ 

' 2!h f °' '^'^ «^P°nents of the sub-network traffic sourcing from 

sa>d first sub-network (Y), that are destined for that sub-network and for said second sub-netwSTm anT 

- adding together the sub-network traffic components so determined for all the sub-networks of s^d grour(R). 

9. A method according to claim 5 or 6. wherein said determining stop derives the relevant said amcmt of ir^m. 
sourcing from sa« flrst sub-network (Y) that is carried by the sSb-networks o, rrgr^pVtakr ^^^^^^^ 

■ detemiining for each sub-networkof said group (R). the components of the relevant sub-network traffic sourc- 
Tx). "nd " ' "^^^ '""^''"^ se^Tnd sSZTk 

' g?o?p p^''''^' ""^ '^^^^"^ ♦'^""^ components so determined for all the sub-networks of said 

10. A method according to claim 4, S or 6. wherein said step of providing association information (40-47 65-75 631 
bvTe mlT^f °' 2 °r3for associating stattons with sakJ first sub-network, the mo^tSg liep effe'cted 

Serrretrrj^miTjo^ 

mSScSn ^' ' inMlor. further enables the said source infor- 

rllno ! ^^"^^^ '° ''^ "'"'^ '° '''^""y "^^^ said first sub-network a said 

devce?i4wr„l . h"?'""'* ".r''' '"'"^"""'"9 ^"'^ ^'^P^ '^^ whetherTipiofng 

the or each station of said first sub-network taken separately. -aiiic irom 

12. Amethod of ascertaining whethertwosub-networksofanetworkaredirectly connected byabi^lirectional spanning 
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device (14). said method Involving carrying out the method ot claim 4 5 or 6 in resoect of traffic co..roj«« * 
said sub-network and then repeating that method for traffic soun:Tng m^Z sISsSeTJ^^^ 

13. A method of ascertaining the topology of at least a portion of a network in terms of its sub-networks and th«ir 
.nterconnectK>n by spanning devices (14), said method invoMng car.ying out the mlSl of any ^^f Sn^ 4 

to determine which of the sub-networks are interconnected by spanning devices. ^^e^iion. whereby 

^rars^rzirf^rr rr^^^^ 

^ ^' fLmnill!!?.^ Ti"^ '° T °"! °' '"^'^'"S "^^^^ ""^"'^^ ^'"^ monitoring step (40-47, 65-75, 63) involves 



Patentanspruche 



ten Kffl Topologiemerkmalen eines Netzwerks. das eine Mehrzahl von Untemetzwer- 

ken UberbrOckungsvornchtungen (14). die die Untemetzwerke mitelnander verbinden. und StationenM ) au- 
Seh^t H r r.'''''''' ''""^ Untemetzwerken zu senden und/oder empfajgr wibii i 
Verkehr », der Form von diskreten Nachrichtenpaketen stattfindet. von denen jedes Quellen- und Be^trmunnt 
Informationen (15) enthaft. dadurch gekennzeichnet. daU das Verfahren folgende SchrS auf wefst ^ 

■ d^lTrirnf H« v""?!! auf zumindest einlgen der Untemetzwerke. urn Daten herzuleiten. die zumindest 
diaUrsprungadesVerkehrs.dorsofibenrachtwird. betreffen. ^ummaesi 

" '^'^ Verkehrsbetrags. der von einer speziellen Quelle stammt. oder eInes Teilsatzes 

zrndrrsS^aTjer^^^^^^^^ 

■ "!f' ^" "estimmen. welcher der Teile des Netzwerks den meisten interessierendan 

SoLT«r "n T"' '^^''""^ TopotoglemerkmSl N^S^^^ 

bezuglich der speziellen Quelle zu bestimmen. ■-"iBiiwerKs 

2. Ein Verfahren des Feststellens. mit welchem Unternetzwerk eine ausgewahlte der Stationen (11) verbunden 1st 

'"'"^-^""^H; - den Nachrichtenpaketen enthalten sind d^u ene^^^ 
d h1„ T H ^" ''^"e" Pakete stammen. wobei der Bestimmungsschritt (65 bi^ 76 84 diu 

dient. den von der ausgewahlten Station (11) stammenden Verkehrsbetrag zu bestimmen der durch iedeVun^r 
netewerkubertragenwird,undwobeiderVergleichs-schri^ 

das den meisten Verkehr von der ausgewahlten Station (11) Obertragt, wobei dieses UnterneSSrk ate Si r!' 
gesehen wird. mit dem die ausgewahlte Station (11) verbunden ist. unternetzwerk ate das an- 

3. Ein Verfahren des Feststellens. mit welchen Untemetzwerken die Stationen (11 ) verbunden sind qemafl Ansoruch 
idJS" Q"«"!'"i"'°'^'i°"e". die in den Nachrichtenpaketen enthalten sind, dazu dIeTen dleSai^Sen zS 
TuTl7"' ^"'^'^ Verfahren das AusfOhren des Jelhrens gemTA^" 

mL?"^^^'^" r.°^'^*«"^"*' Unternetzwerk (Y) durch die UberbrOckungsvorrichtung (14) direkt 

mit einem zweiten Unternetzwerk (X) veitunden ist. gemaB Anspruch 1, wobei: ^ ' ' 

- das Verfahren den Schritt des Liefems von Zuordnungsinformationen (40 bis 47. 65 bis 75. 63) aufweist die 
urn em Nachrichtenpaket als von dem ersten Unternetzwerk (Y) abstammend zu kJentiflzieren; 

■ f ^'i2rMn!'""T^"!.'i'°.^'' ^''^ Uberwachen des Verkehrs auf dem zweiten Unternetzwerk (X) und 
auf jedem Unternetzwerk der Gruppe (R) von Untemetzwerken. die aus alien von dem ersten und dern zweitSn 
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Unternetzwerk verschiedenen Untemetzwerkon gebildet ist, einschlieBt; 

' ?Y[.!f """T^ vf^J'u 'I' Bestimman von MaBen der von dem ersten Teilnetewerk 

(Y)stammendenVerkehrsbetrage,diedurch das zweite Unternetzwerk (X)und die Untemett^^^^ 
pe (R) von Unterneuwarken Obertragen we^en. unter Verwendung der kUungsinfoS^^ 

- der Vergletehsschritt (105) wirksarn ist. um die Ma6e zu verwenden. um die von dem ersten Unternetzwerk 
Y)stammendanVerkehrsbatraga([T,)x,[T,W,diaj9wailsdurch das zweite Unternetzwerk (^^^^^^ 
Unternatzwarka dar Gruppa (R) zusammenganomman Qbartragen wereJen. zu vergleichen wobai daTva 
ztatn S^v^rr' h"' U^-brOckungsvomchtung (14) das erste UntarneUwerk (Y)"reW mit d^m 
tragJnX "^'^'^^ Verkehrsbetrage durch das zweite Untemetzwerk (X) Obe^ 

^' fiA» dilS! m^?' Feststellens ob ein erstas der Unternetzwerke (Y) durch eine der OberbrOckungsvorrichtungen 
(14) dirakt mit einem zweiten der Unternetzwerke (X) verbunden ist. gemal) Anspruch 1. wobai: '""^"^^ 

' ?r^t^hen " '"'^'^'"^ ^"°^"""9®'"*°^^'°"8n (40 bis 47. 65 bis 75. 63) aufwalst. die 

(a) das die Quelleninformationen. die in einem Nachrichtenpaket enthalten sind. verwendel werden um 
e,n Nachrichtenpaket als von dem ersten Untemetzwerk (Y) stammend zu identifizieren; und 

(b) das die Bestimmungsinformationen. die In einem Nachrichtenpaket enthatten sind, verwendet warden 
WemiSzterer "''^''^ ^'^'^ Bestimmung als das zweite Untemetzwerk (X) aufweisend zu 

- der Oberwachungsschritt (40 bis 47, 65 bis 75, 63) das Oberwachen des Verkehrs auf dem zweiten Unt«r 
netzwerk(X)undaufJedemUmemeUwerkderGruppe(R)vonUntemetzwerken^^^^ 

und dem zwerten Untemetzwerk verschiedenen Untemetzwerken gebildet ist, einschlieOt; 

■ t'lT^T^T''^ Bestlmmen von MaOen dar von dem ersten Unternetzwerk (Y) 

abstammenden und eine andere Bestimmung als das zwefte Untemetzwerk (X) aufweisenden VbrkThrsbe 
rage, d.e durch das zwerte Untemetzwerk (X) und die Unternetzwerke der Grippe (R) v^CemeteweJen 
ubertragen werden. unter Verwendung der Zuordnungsinfomationen aufweist; und ""«"'«^werken 

- dar Vergleichsschritt (96) wirksam ist, um die MaBe zu venwenden, um die von dem ersten Unternetzwerk m 
starnmendan ""f«";;«a"^^ere Bestimmung als das zweite Untemetzwerk (X) aufweisenden VerkehrsbetrSge 
Inlhl^''"^' J^^^"! ''""^^ '^^ Unternetzwerk (X) und durch die Untemetzwerke der Gruppe (R) 
zusammengenommen ubertragen warden, zu vergleichen. wobei der Vergleichsschritt bastimmt daB eine 
U^rbruckungsvornchtung (14) das erste Unternetzwerk (Y) direkt mit dem zwerten (X) veSndet weSn Tr 
groBere d.eser Verkehrsbetrage durch das zweite Untemetzwerk (X) ubertragen yiM. 

^' fi'i ""-^ Feststellens. ob ein erstes der Unternetzwerke (Y) durch eine der Uberbruckungsvorrichtungen 

ZTZ^T ^ H " « ''"^ P^'^'^ ^'^^"^ ^i"*^. "-^ 2" verhindem SSh- 

chtenpakete mrt einar Bestimmung auf einem verbundenen Untemetzwerk durch die Uberbruckungsvorrk:htunQ 
(14) von diesem Untemetzwerk zu einem anderen zu gelangen. wobei: orucKungsvorrichtung 

' ^dSfchen^" ''^^ ^^^^'"^ ""^ ^"°'*""9s'"'°f"«"o"e" (40 bis 47. 65 bis 75, 63) aufweist. die 

2Ii?rh''Sh?^"^;]*"/°r^*'°?"' "^'^ ^'"^"^ Nachrichtenpaket enthalten sind. verwendet werden. um 
em Nachnchtenpaket als von dem ersten Untemetzwerk (Y) stammend zu Wentiflzieren; und 

(b) daB die Bestimmungsinformationen. die in einem Nachrichtenpaket enthalten sind. venwendet werten 
um em Nachrichtenpaket als eine Bestimmung auf dem ersten Untemetzwerk (Y) aufweisend zu kJenti- 
Tizieroiii 
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de Uberwachungsschrrtt (40 bis 47) das Uber^achon des Verkehrs auf dem zweiten Unternetzwerk (XS und 
aujsdemUntemet2werkdGrGruppe(R)vonUntemet™erken.dieausallenvondem^^^^^^ 

abstammenden und eine Bestimmung auf dem erBten Unternetzwerk (Y) aufweisenden VerkehTbaSoL S 

' ^/J^o' f ^'"l""" '^f ^ ^"^'^'^ '"^ ^" verwenden. um die von dem eisten Unternetzwerk m 
slammenden und e,ne Bestimmung auf dem ersten Unternetzwerk (Y) aufweisenden VferkeSS^^ ^ 
rn^knln! . r Unternetzwerk (X) und durch die Untemetzwerke der G ruppeTR) zS: 

mengenommen ubertragenwerden. zuvergletehen. wobeiderVergleichsschrittbestimmt das reOberoT 
ilZTf Unternetzwerk (Y) direkt mit dem zweiten (X) veSet tSoT^^ ^re 

dieser Verkehrsbetrage durch das zweite Unternetzwerk (X) Obertragen wird. ° 

7. Ein Verfahren gemaR Ansprucli 4, 5 Oder 6. bei dem der Bestimmunasschritt m- PR- qr\ Hn« ,oi«w« . 

genommen ubertragen w.rd. durch das Zusammenaddieren der entsprechenden Verkehrsbeuie fOr^X un 

temetzwerkderGmppe(R)ungeachtetjedarVervlelfachung.dieals^nErgebnisdessen 

nchtenpaket auf mehr a,s einem Unternetzwerk der Gruppe^berwachl wiKltretrk^J^^^^^^^^ 

°' ^unnTT^" f '^^'^ T^"""^ ^' ""^ Z^ordn'^ngsinformationen femer emioglfchen dalJ die Bestim 

m ngs- ntomiat,onen. d.e ,n einem Nachrichtenpaket enthalten sind. venvendet werden Sm 5ks tSrmmun^" 

(Y sZT/nln'v ff .'"/^^^ 
;iL!SoT^TeSe^^ 

" Ihi^r ^"f Bestimmen der Komponenten des von dem ersten Unternetzwerk (V) 

£t?mm7s;Tund ^'^^^ ^"'^"'^^-^^ ""'^ '"^ ^-«« Untem^etS S 

■ ^rdTGC'J^'' ^"♦^"^^'^"-^■^^^^^►"^'^^"'PO"^"'-. so best^mt werden. fOr alls Untemetz- 

^' T/L? T'^'^ '^^^'""^ ^ ^' ^^"^ "^^^ Bestlmmungsschritt den relevanten. von dem ersten Unter 

netzwerk (Y) stammenden Verkehrsbotrag. der durch die Untemetzwerke dar rsrnnno /n 
Obertragen wird. wie folgt herleitet: untemetzwerke der Gruppe (R) zusammengenommen 

- f Or jedes Unternetzwerk der Gruppe (R) Bestimmen der Komponenten des relevanten von dem ersten Ur, 

rwr(TrmTrd:r^^"^ 

■ fZ2::::^:roC:Z'''^ Untemetzwerk-Verkehrskomponenten, die so bestimmt sind. f Or ai.e Un- 

bJ-)? 65tr7rfit?^"'f;"f ' ^' '^"^ ^^^^^^ ^^^^ "-ietems von 2uo«lnungsinformattonen (40 
,1!' ^ ^ ^ernaB Anspruch 2 Oder 3 zum Zuordnen von Stationen zu dem e^en Un 

te netzwerk aufweist wobeiderUberwach^ 

wetelierSlat,onaufdemersten Unternetzwerk einesderNachrichtenpaketestammtewo^^^^^^^ 

der yerg eichs-Schrrtt zum Bestimmen. ob eine OberbrOckungsvorrSchtung (14) zwiscSn 2m e^n u^^^^^^^^ 

Sonen dlTTt l^' """^"^'^ ^'"^^ ^etrennten Verwending des VerkehrvonTe S den 

Stationen des ersten Unternetzwerks durchgetOhrt wird. 
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13. Ein Verfahren des Feststellens der Topologie von zumindest ehem AbschnW eines Netewerks hinsichtlich seinar 

DurchJOhren des Verfahrens gemaB einem beliebigen der Anspruche 4. 5 oder 6 bezuS ed^^^^^^^^ 

UnernetewerkendesNetzwerksoderdesbetrachtetenAbschnittsdesselbenaufweistum^^^^^^ 

welche der Unternetzwerke durch OberbrOckungsvorrichtungen mfteinander verbunin sS^ ■ 

'v7T t^"""^'" ^°'*'«^9°'^e"*" AnsprOche. bei dem der Bestimmungsschritt (65 bis 
75) die Erzeugung von Verkehrstnatritzen fOr jedes Untemetzwerk autweist. 

''^"^'"Se" der vorhergehenden Anspruche. bei dem der Uberwachunosschrht 
(94. 96. 98) das Bew.rken seiner Bestimmung durch das Venvenden eines Hypothesetestens bewirkt. 



Revendlcations 



■ rilfH^^r .H ^!^"f °f topologiques d'un r6seau qui comprend une plurality de 8ous-r6seaux 
des dispositrfs d-extension (14) interconnectant les sous-r6seaux. et des stations (11)Lctkmnan?en 6meS 
dfl,! H ' ? '«^P~venant des sous-rSseaux. le trafic 6lan sous !a Ce de paSs 

' rrsro^iSSsd:^^^^^^^^ 

' enlrri".?. TT^ ""^"'"^ ^y^' P"'^ partlculifire. ou d'un sous- 

u'^e iZ?" ''"^ '^''"^ ^'"^ P^^"'*™ comprenant au 

- compataison desdites mesures pour determiner laquelle desdrtes parties du r^seau aohemine le plus de trafic 
tionndes du rteeau, concernant ladite source particulifire. t«H"ioaiquB5 seiec 

Proc6d6 selon la revendicallon 1, pour verifier auquel dit sous^6seau une dite station s6lectionn6e (11) est con- 
nec^e lorsque lesdrtes informations de source incluses dans lesdits paquets de messages srn/entV IdenWie^^^^^^ 
a^^^t „n ^T'""*'- ^"^^ determination (65-75. 84) servant ^ dSte^iner rquanSe^e traS 

ayant pour ongine iadite station s6lectionn6e (11). qui est transports par chaque dit sous-rSsrau rildit7it«„! 
de co,T,para.K.n (85-87) impllquant la determination du sous-rSseau t^anspoSant la ,^^ufe7nie£tafS^ 

--'^-^ — "Li atq^rreSs 

lo,^ot1«S»«* revendication 1 , pour verifier auquel desdits sous-reseaux lesdites stations (11) sont connect6es 
torsque lesdites infomr,ations de source Incluses dans lesdits paquets de messages servent S identffler l^sSons 

sTa i^n mt fyr'n 'T''' "'"^^'^'"^ ''''''''''' ''''''' rlendicatl % J^^^^^^^^^ 
station (11), I etape de surveillance (40-47) etant executes concurremment pour toutes les staiions. 

Procede selon la revendication 1 . pour verifier si un premier dit sous-reseau (Y) est direclement connecte oar un 
dit disposrtif d'extension (14) k un deuxiSme dit sous-r6seau (X), dans lequel: ^O""®^^^ un 

• ledit procede conriporte l'6tape de fourniture d'informations d'association (40-47. 65-75. 63) permettant auxdi- 

m ™ ™? '"^^^Ses d-etre itilisees pour idemCn pa^uet 

messages comme ayant son ongine sur ledit premier sous-r6seau (Y)- 

■ ifrl'htn^ 1" surveillance (40-47) comporte la surveillance du trafic ;ur ledit deuxi^me sous^6seau (X) et 
sur Chaque sous-rdseau du groupe (R) de sous-rdseaux constltu6 de tous lesdits sous-r^seaux dSfir^^^^^^ 
desdits premier et deuxifeme sous-r6seaux: amerems 
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- ladi e 6tapededdterminatK)n (65-75. 102-103) comporte la ddtermination, ^ raids desdites informations tfas 
soc.at.on de mesuros dos quantiWs du trafic ayant son origine sur ledit premier sousiseauTS cui Jn 
^sport^es par ledi. deuxi.me sous-r.seau (X) e, ,es sous'eseaux dudif group! R d so^^^^^^^^^^^^^ 

,1, ^ '^"^ ^ P^ni'sf sous-r6seau (Y). qui sont respectivement xran^^,^Zl 
par ledrt deux,6me sous-r6seau (X) et par les sous-rdseaux dudit groupe (R) oor^i6t!^,J,7Zbl7T£Tj, 
compara^n djerminant qu'un dispositit ^extension (U) conne^te dUtem^le J^^r^^^^^^^^^^ 

^' "^"^ ^'^'^ ''^^ '^"^"^"'^ '^^""^ '--P°^^« ZiLme sois. 

ProcedS selon la revendication 1 , pour v6rifier si un premier dit sous-r6seau (Y) est directement connprta „», „n 
dit d,spositif d-extension (14) ^ un deuxiSme dit sous-r6seau (X). dans iiuel: f^' 

- ledit p,ocW6 comporte l'6tape de toumiture d-fntormations d'associatlon (40-47. 65-75. 63) permettant: 

ulllTJla^^'"'^''°"^ P^^"^' messages, d'etre utilisdes pour identifier 

un paquet de messages comme ayant son origine sur ledit premier sous-r6seau (Y)- et 

trfier un paquet de messages comme ayant une destination diffdrente dudit deuxitaie sous-r6seau (X); 

■ S«!.fS' T ^^-^S- comporte la surveillance du trafic sur ledit deux»me sous- 

JhT f h "'"r ^°"^-^^seau du groupe (R) de sous-r^seaux constitu6 de tous lesdits soH^ux 
ditfdrents desdits premier et deuxidme sous-r6seaux- reseaux 

- ladite 6tape de d6temaination (65-75. 96) comporte la'd6temiination. d Taide desdites informations d'assocla- 
ton de mesures des quantit^s du trafic ayant son origine sur ledit premier sous-reseau (Y) et ay^t^^e 

r ' ^^"^'^'^^ (X). -nt transport^es par ledit de Jme iusSsZ 

(X) et les 80U8-r68eaux dudit groupe (R) de sous-r6seaux- et »ou8-reseau 

H i?7 ''I?'"" '^'^^ P^^'"'^^ sous-r6seau (Y) et ayant une destination diffSrente 

dud deuxi^me sous-raseau (X), qui sont respectivement transport^es Wr led!; deuxi Je sJS ZTu ^ 2 
S'd'ientfrn^^^^^^^^ groupe (R) consid^r^s ensemble. P6tape de comparaison determinant qu'u di ! 
posit^ d extension (14) connecte directement le premier sous^eseau (Y) au deuxifime (X) lorsque la olus 
grandedecesquantit&detraficesttransport6eparleditdeuxi6mesous-r6seau(X). 

Proc6d6 selon la revendication 1 , pour verifier si un premier dit sous-r6seau (Y) est directement connects oar un 

^ lu'^'alsaT^^^^^ ' V""'""' '^^ "^'"^^ d'extensr(T4ri2 dans 

reseau n agissant pas parfaitement pour empdcher les paquets de messages, ayant une destinat on sur un 
r^seau connect., de traverser le dispositit d'extension (14) depuis ce souLs^ulTun iSfdans ^^^^^^^^^^^^ 

- ledit procMg comporte I'dtape de foumiture d"infomiations d'associatlon (40-47. 65-75. 63) permettant: 

m n^nffn '"^'^^^s dans un paquet de messages d'etre utilisees pour identifier 

un paquet de messages comma ayant son origine sur ledit premier sous-r6seau (Y) • et 

tmlruf „"!n,?H"™"°"' P^''"^' '"^^^S^s d'etre utilisees pour iden- 
tifier un paquet de messages comme ayant une destination vers ledit premier sous-reseau (Y) ; 

" de sun/eillance (40-47) comporte la sun/eillance du trafic dudit deuxidme sous-rdseau (X) et sur 

' !2? hI'^^ d^temiination (65-75. 98) comporte la determination. S I'aide desdites infomiations d'associa- 
jon de mesures des quantites du trafic ayant son origine sur ledit premier sous-reseau (Y) et ayant^re 

les sous-r6seaux dudit groupe (R) de sous-r6seaux et * ' 

' de frlff «T (98) fonctionne en util'isant lesdites mesures pour comparer lesdites quantites 

r!P".' ^H"^ sous-reseau (Y) ayant une destination sur ledit prenJer sous 

reseau (Y). qui sont respectivement transportees par ledit deuxifeme sous-reseau (X) et par les souT reseaux 
dudit groupe (R) consider6s ensemble, retape de comparaison detemilnant qu'un d spositi tfeZ Ji^ n4i 
connecte directement lepremler sous-reseau (Y)audeuxieme(X) lorsque la plus granSe dles^^^^^^^^ 
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trafic est transpoitte par ledK deuxi^me sous-r6seau (X). 

Proc6d6 selon la revendication 4. 5 ou 6, dans lequel ladite 6tape de determination (94; 96; 98) determine la 
quant.t6 concernSe de trafic ayant son origine sur ledH premier sous^6seau (Y) qui es trans J^rious ■ 
r6seaux dudit groupe (R) pris ensemble, en additionnant ensemble les quantWs de trafic XXmes po r 

du fart que le mSme paquet de messages a 6\6 suiveM sur plusieurs sous-r6seaux du groupe. 

Proc6d6 salon la revendicattan 4. dans lequel lesdites informations d'association permettent en outre auxdites 
.nformat,ons de dest.nat.on contenues dans un paquet de messages d'Stre utilisdes pour identifit; l^s^s "ieau 
dedej.nat,ondu paquetjadite 6tapede determination (94)d«e^ 

sur ledrt prem.er sous-r6seau (Y) qui est transport* pas les 80us-r6seaux dudit groupe (R) considlfersZle 
on. * 

- determinant pour chaque sous-r6seau dudit groupe (R) des composanls du trafic du sous-r6seau ayant son 
or jrne sur ledrt premier 60ua-r6seau (Y). qui sont destines & ce sous-r6seau at audit deuxiftme sous reseau 

- ajoutant ensemble les composants de trafic de sous-reseaux ainsi determines pour I'ensemble des sous- 
reseaux dudrt groupe (R). 

P;°^ff ««l°".'a^svendicatlon5ou6. dans lequel bdlte 6tape da determination determine ladite quantite de trafic 
siSsTn3le!en f 'l"' "^"^P°«^ sous-reseaux dudit groupe (R)2n- 

• determinant pour chaque sous-reseau dudit groupe (R) des composants du trafic du sous-reseau concem6 
SrSau"m.^r' sous-reseau (Y). qui sont destines ft ce sous-reseau et audit deuxifeme 

■ SutrirardX^^^^^^^^^^ 

65-75. 63) imphque le precede de la revendication 2 ou 3 pour associer des stations audit premier sousVeseau 
I etape de surveillance effectue par le proc6d6 de la revendication 2 ou 3 etant execute soil independamment soit 
conjouitement avec retape de surveillance presentee dans la revendication concemee des revendSnsTs ou 

11. Procede selon la revendication 4. 5 ou 6. dans lequel lesdites informations d'association permettent en outre 
station dudit premier sous-reseau, un dit paquet de messages est originaire; lesdites etapes de determination et 
l"r3urf7xT'etforf""r'; ^''^ ''^'^^"^ ^"'^^ ■-'"^ premierrSm 
pTerrsVe's^u.Sidre?^^^^^^^ ~ "''"^ °" ^« ^'^^^^ 

12. Procede pour verifier si deux sous-reseaux d-un reseau sont directement connectes par un dispositif d'extension 
bid.rectionnel{14)Jedit precede impliquantrexecutionduprocededelaravendication4^^ 

?ans?ardr8ou°s'^^^^^^^ " ^ ""9- 

13. Precede pour acquerir la topologie d'au moins une partie d'un reseau en temies de ses sous-r6seaux et leur 
interconnexion par des dispositifs d'extension (14). ledit procede comportant I'execution du precede selon I'une 
quelconque des revendications 4. 5 ou 6, en ce qui concerns chaque appariement de sous-reseaux du reseau 

d^sTpo's: d4Tenrer''"''^'°' ' '^•"'"'"^ '^^''"^'^ 

14. Pf«:edeselonrunequelconquedesrevendicattonsprecedentes.danslequelladiteetapededeteTO 
implique la generation de matrices de trafic pour chaque sous-reseau. 

16. Procede selon funa quelconque des revendications precedentes. dans lequel ladrte etape de surveillance (40-47. 
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65.75. 63) implique I'dchantillonnage du trafic sur les sous-rdseaux, ladite 6tape de comparaison (94- 96- 98) 
effectuant sa determination en utilisant une vdrification d'hypoth6ses. Rcir^'son ^y^. sb. sb) 
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